fix: accept the event and SSO queries workos-go v10 sends

[awartoft]

Summary

workos-go v10.5.0 cannot drive the current emulator for the calls a directory-sync poller and a social login make. Confirmed by pointing that client at unmodified main (de4ccdc):

• Events().List with events: ["user.created"] also returned organization.created. The SDK encodes the filter as repeated events= (url:"events"), and GET /events only read events[].
• The same list ignored organization_id and a range_start an hour in the future. Both events from a two-organization seed came back, and so did an event created before the range.
• SSO().GetAuthorizationURL with provider=GoogleOAuth returned 404 connection_not_found after a GoogleOAuth connection existed. Authorizing with that connection's id still returned 302 and a code.
• After seeding a directory user into a group, Events().List for dsync.group.user_added returned dsync.user.created, dsync.group.created, dsync.activated, and organization.created.

This keeps Directory Sync read-only over HTTP. Membership events are emitted when a seeded or updated directory user's group set changes, including dsync.group.user_removed when the user leaves a group or is deleted. events[] still works. List order is unchanged: the v10 iterator sends order=desc itself when the caller omits it.

Test plan

• bun test on the events, SSO, directory, and directory-seed specs
• bun test full suite (1280 pass) before this branch
• Reviewer: GET /events?events=user.created&events=user.updated returns only those types
• Reviewer: GET /sso/authorize?provider=GoogleOAuth redirects when an active connection of that type exists

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable new defect remains, and all prior findings were manually resolved after the current code addressed their selection and scoping cases.

Summary

This PR expands WorkOS SDK compatibility across event filtering and organization scope, SSO provider selection, directory membership events, Connect application management, Client API tokens, and specification-derived identifier validation.

• Records internal event organization scope without exposing it in public event payloads.
• Supports repeated events= filters and additional event-list query constraints.
• Resolves SSO provider requests while rejecting ambiguous tenant matches.
• Emits directory group membership lifecycle events.
• Adds Connect application and client-secret lifecycle endpoints plus Client API token issuance.
• Aligns generated resource ID prefixes and response contracts with the OpenAPI specification.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  SDK[WorkOS SDK] --> Events[Events API]
  SDK --> SSO[SSO authorize]
  SDK --> Connect[Connect application APIs]
  Seed[Directory seed/update] --> Bus[Event bus]
  Bus --> Store[Stored events]
  Events --> Store
  SSO --> Connections[Organization-owned connections]
  Connect --> Applications[Applications and client secrets]
  Applications --> OAuth[OAuth token exchange]

Loading

_{Reviews (6) · Last reviewed commit: "Merge remote-tracking branch 'origin/mai..."}

[gjtorikian]

thanks!